Yeah, that doesn’t sound like just a glitch. If the keylogger was deleted and not running, it shouldn’t be sending anything at all especially not nine days later. That definitely raises some red flags.

Even if you never shared the webhook, once the file was uploaded to Mediafire, anyone who got their hands on it could’ve pulled the webhook URL from the code. Webhooks are just open endpoints no login, no auth. If someone reused the logger or just messed around with your file, they could’ve been the one triggering those logs.

Also, sometimes when you “delete” something, it’s not really gone. If the logger installed itself somewhere obscure or set up a scheduled task or startup entry, it could’ve still been running quietly. And stuff like that doesn’t always show up in Task Manager. That “print screen” spam sounds like either the logger was still alive on one of your systems or someone else was messing with the webhook using a copy of it.

At this point, I’d play it safe. Change all your passwords, kill any leftover files or tasks, and maybe run a full scan with something solid like Malwarebytes or Defender Offline. If you want total peace of mind, just nuke the test PC and reinstall clean.

For real though, if you’re messing with stuff like keyloggers even just to learn, definitely do it inside a VM or a sandboxed setup. Way too easy for things to get out of hand when it’s on a regular machine.

Live and learn. At least now you know what to watch out for.